Automatic generation of training data for anomaly detection using other user's data samples

Abstract

A method for anomaly detection on a system or application used by a plurality of users includes providing an access to a memory device storing user data samples of a usage of the system or application for all users of the plurality of users. A target user is selected from among the plurality of users, using a processor on a computer, with data samples of the target user forming a cluster of data points in a data space. The data samples for the target user are used to generate a normal sample data set as training data set for training a model for an anomaly detection monitor for the target user. A local outlier factor (LOF) function is used to generate an abnormal sample data set for training the anomaly detection monitor for the target user.

Description

[0001]This Application is a Continuation Application of U.S. patent application Ser. No. 14 / 840,270, filed on Aug. 31, 2015.BACKGROUND[0002]The present invention relates to security on computers, and more specifically, a method to train a model for an anomalous behavior monitor for individual users. More specifically, the present invention teaches an adaptation of the Local Outlier Factor (LOF) algorithm to select benign samples from the target user's own data points and to select anomalous samples from other system users' data points so that, both anomalous and benign samples can be obtained for training an anomaly detection model for the target user.INTRODUCTION[0003]Machine learning (ML) is increasingly used as a key technique in solving many security problems such as botnet detection, transactional fraud, insider threat, etc. Driven by an almost endless stream of well publicized cases, such as Wikileaks and Snowden, of information theft by malicious insiders, there is increased ...

AI Technical Summary

Benefits of technology

The present invention is a method for automatically generating both benign and malicious training samples from unlabeled data. The method leverages other users' samples as "abnormal" samples to help a ML classifier learn a boundary between the target user's expected and unexpected behavior. The method does not require any assumptions about the distribution of anomalous samples and is independent of any underlying learning algorithm. The method was tested on several datasets and was found to perform significantly better than traditional classification methods. The technique can be used in many security applications.

Problems solved by technology

Thus, anomaly detection has been an important research problem in security analysis.

Anomaly detection, however, has been a challenge in such security analysis.

One of the key challenges to the widespread application of ML in security is the lack of labeled samples from real applications.

However, in many security applications, it is difficult to obtain labeled samples, as each attack can be unique, and, thus, applying supervised techniques such as multi-class classification is not feasible.

These methods, however, tend to yield high false positive rates, preventing their adoption in real applications.

This is often very difficult for security applications: it is often unrealistic to expect to gather enough anomalous samples for labeling.

This lack of anomalous samples prohibits the applicability of more accurate classification techniques, and, therefore, most existing monitoring applications have adopted anomaly detection or one-class classification techniques.

These methods construct a profile of a subject's normal behavior using the subject's past behavior by treating them as benign samples and compare a new observed behavior with the normal profile, resulting in high false positive cases.

In some situations, there may be only a small number of samples to learn a user's normal behavior, or the user's samples actually contain anomalous cases, and, thus, training with this data can result in high false negative rates.

However, this method is not applicable to data with a very high dimensionality or with continuous variables.

While these data points are generated from the data, they do not represent actual behavior in most real-world problems.

But it restricted the underlying classification algorithm to produce class probability estimates rather than a binary decision.

Despite some successes of the above methods, they suffer either from strong restrictions, which made them not applicable to problems with high dimensional data, other application domains, or from the requirement of estimating the reference data distribution, which is usually not accurate and may lead to suboptimal performance.

Images